CONTROLS TESTING VS SUBSTANTIVE TESTING: A PRACTICAL APPROACH CPA MADHAV BHANDARI MANAGING PARTNER AT BAKER TILLY MERALI S NOVEMBER 2017 1
INTRODUCTION What are the common audit problems? Inadequacy of acceptance Inadequacy of Planning Inadequacy of Execution Inadequacy of Completion independence and resources KOEE, risk, approach not following planning, wrong tests, no documentation, materiality, sampling review, client pressure 2
INTRODUCTION How do we know these are the common problems? https://www.ifiar.org/ifiar-global-survey-of-inspection-findings.aspx Do the ISAs address the problems? Are you applying ISAs properly? How do you improve your audits? 3
ROOT CAUSE ANALYSIS Finding insufficient work performed on a significant Audit Risk First why: The audit team member performing the work did not understand how to address the audit risk Second why: Third why: The audit manager was not briefed by the audit partner and so could not adequately brief the audit team The audit partner did not adequately brief the audit team member on the audit strategy Fourth why: The audit partner was not around at the planning stage Fifth why: The audit partner had other commitments and wasn t able to brief the audit team 4
AUDIT APPROACHES Essentially there are four different audit approaches: The substantive procedures approach This is also referred to as the vouching approach or the direct verification approach. In this approach, audit resources are targeted on testing large volumes of transactions and account balances without any particular focus on specified areas of the financial statements The balance sheet approach Substantive procedures are focused on balance sheet (statement of financial position) accounts, with only very limited procedures being carried out on income statement/profit and loss account items. The systems-based approach Requires auditors to assess the effectiveness of the internal controls of an entity, and then to direct substantive procedures primarily to those areas where it is considered that systems objectives will not be met The risk-based approach Audit resources are directed towards those areas of the financial statements that may contain misstatements (either by error or omission) as a consequence of the risks faced by the business 5
INTERNAL CONTROL TESTING ISA 315: Requirements The auditor shall obtain an understanding of internal control relevant to the audit. Although most controls relevant to the audit are likely to relate to financial reporting, not all controls that relate to financial reporting are relevant to the audit. It is a matter of the auditor s professional judgment whether a control, individually or in combination with others, is relevant to the audit. the auditor shall evaluate the design of those controls and determine whether they have been implemented. 6
INTERNAL CONTROL TESTING Important to remember - ISAs require the auditor to evaluate the design and implementation of the client s internal controls. Requirements from ISA 315 Identify and assess the Risks of Material Misstatement through understanding the entity and its Environment. It is clear that the internal controls should be understood and evaluated. The ISA goes on to say that enquiry alone is not sufficient to perform this evaluation. Usually walk through tests are the best way to check that the controls have been implemented and to confirm that the auditor has correctly documented the systems and controls. The evaluation should cover all significant transaction cycles and the auditor should assess the strength or otherwise of the control system. If the auditor s assessment is positive, the auditor may decide that testing internal ICPAK controls will be an effective approach. 7
INTERNAL CONTROL TESTING Why spend time on controls when a wholly substantive approach is planned? ISA requirement Understand the business Deal with risks arising from poor controls Which client would you prefer? Weak internal control system? Strong internal control system? 8
INTERNAL CONTROL TESTING Why document the internal controls when a substantive audit is envisaged? The obvious, but unhelpful answer is to say that ISA 315 requires this a bit like parents telling children off and saying this is wrong because I say it s wrong!. Some more helpful answers are: It helps the auditor understand the business and therefore provides an opportunity to perform the audit more efficiently. Also poor controls may result in increased risk. The auditor needs to know the areas of risk in order that adequate resources can be allocated to addressing the risk and to ensure that sufficient evidence is obtained to reduce the risk to an acceptable level. 9
INTERNAL CONTROL TESTING Reliable system and controls approach Evidence of application of control Key controls Design appropriate test Audit assertions Whole accounting period Interpretation of results and impact of a failure 10
INTERNAL CONTROL TESTING Matters to consider. For a client audit, the auditor assesses the system of control as reliable. The auditor decides to place reliance on the system of control and therefore must test the controls. In making this decision, the auditor must consider whether there is evidence that the control has been applied without this, it is not possible to test the control. The auditor should only test key controls these are the controls which may prevent, detect or correct a material misstatement. I have seen a number of working papers for controls testing that appear to cover a vast number of controls my reaction is usually negative. The test is basically an expanded walk through test and it will almost certainly not prove what it has been designed to prove. The test should be designed to deal with the key controls and should be linked to proving audit assertions. The test should also cover the whole of the accounting period. ISA 330 The Auditor s Responses to Assessed Risks gives quite a lot of guidance, particularly in the appendix, to help with tests of control. 11
BASICS CONTROLS Nothing to do with numbers directly. Control activities are really policies and procedures to prevent or to detect and correct errors. They comprise: Authorization; Performance Reviews, Information Processing, Physical Control, Segregation of Duties E.g. Bank Reconciliation Controls review + senior person reconciling - 30 June example for 31 Dec year end - given an indication for number testing at year end E.g. Purchase LPO approval/match invoice to LPO/P/ment posting/printer cartridge (CAN T DO 100% CONTROL TESTING ONLY) gives an indication of accuracy of numbers SUBSTANTIVE Numbers E.g. listing of transactions - cartridge costs (P&L) - Invoice test (testing for numbers) 12
AUDIT IS MORE OF AN ART FORM(FLUID) as opposed to being scientific Design and control for example Changes to audit programmes 13
ISA S 330 AND 315 CONTROL v/s SUBSTANTIVE ISA 330 The auditor should design and perform further audit procedures whose nature, timing, and extent are responsive to the assessed risks of material misstatement at the assertion level The auditor s assessment of the identified risks at the assertion level provides a basis for considering the appropriate audit approach for designing and performing further audit procedures. In the case of very small entities, there may not be many control activities that could be identified by the auditor. When the auditor s assessment of risks of material misstatement at the assertion level includes an expectation that controls are operating effectively, the auditor should perform tests of controls to obtain sufficient appropriate audit evidence that the controls were operating effectively at relevant times during the period under audit. When, in accordance with paragraph 115 of ISA 315, the auditor has determined that it is not possible or practicable to reduce the risks of material misstatement at the assertion level to an acceptably low level with audit evidence obtained only from substantive procedures, the auditor should perform tests of relevant controls to obtain audit evidence about their operating effectiveness 14
ISA S 330 AND 315 (CONTROL v/s SUBSTANTIVE ISA 330 (cont. ) The auditor should perform other audit procedures in combination with inquiry to test the operating effectiveness of controls. If the auditor plans to rely on controls that have not changed since they were last tested, the auditor should test the operating effectiveness of such controls at least once in every third audit. Substantive procedures are performed in order to detect material misstatements at the assertion level, and include tests of details of classes of transactions, account balances, and disclosures and substantive analytical procedures. Irrespective of the assessed risk of material misstatement, the auditor should design and perform substantive procedures for each material class of transactions, account balance, and disclosure. When substantive procedures are performed at an interim date, the auditor should perform further substantive procedures or substantive procedures combined with tests of controls to cover the remaining period that provide a reasonable basis for extending the audit conclusions from the interim date to the period end Based on the audit procedures performed and the audit evidence obtained, the auditor should evaluate whether the assessments of the risks of material misstatement at the assertion level remain appropriate. 15
ISA S 330 AND 315 (CONTROL v/s SUBSTANTIVE ISA 315 The auditor shall obtain an understanding of internal control relevant to the audit. Although most controls relevant to the audit are likely to relate to financial reporting, not all controls that relate to financial reporting are relevant to the audit. It is a matter of the auditor s professional judgment whether a control, individually or in combination with others, is relevant to the audit. An understanding of internal control assists the auditor in identifying types of potential misstatements and factors that affect the risks of material misstatement, and in designing the nature, timing and extent of further audit procedures. 16
EXAMPLE: CONTROL S Example1: Property Developer. Operations director conducts detailed review (including checking prices) on the site manager WIP reports for each project and determines the value of WIP and Sales to date. Clear policies on revenue recognition. What do we test? We must test these controls as our assessment of risk at the assertion level is based on an expectation that controls are operating effectively. Give a test? Example 2: Advertising Agency which devises and records commercials for broadcast on FM Radio. Length of each commercial is determined by FM station. Revenue is management fee by agency plus pay per time. All done by IT systems. What do we test? We must test revenue recognition, we only have limited assurance on completeness of sales from substantive tests and we need to test computerized controls on recording and authorization. 17
ISA S 330 AND 315 (CONTROL v/s SUBSTANTIVE ISA 315 (Risks of material Mis-statement) The division of internal control into the following five components, for purposes of the ISAs, provides a useful framework for auditors to consider how different aspects of an entity s internal control may affect the audit: (a)the control environment (ISA 315-14); (b)the entity s risk assessment process(isa 315-15); (c)the information system, including the related business processes, relevant to financial reporting, and communication (315.12); (d)control activities (ISA 315.14); and (e) Monitoring of controls(isa 315 22-24) The division does not necessarily reflect how an entity designs, implements and maintains internal control, or how it may classify any particular component. Auditors may use different terminology or frameworks to describe the various aspects of internal control, and their effect on the audit than those used in this ISA, provided all the components described in this ISA are addressed. 18
CONTEXT DIAGRAM 19 SAMPLING MATERIALITY AUDIT REPORT AUDIT PROGRAM AUDIT STRATEGY AUDIT RISK MODEL INHERENT RISK CONTROL RISK AUDIT EVIDENCE ASSERTION SUBSTANTIVE APPROACH CONTROL S APPROACH
AIM 20 Do controls operate as designed? Adjustments to risk model/substantive tests
CONTROL S ENVIRONMENT 21 CONTROL ENVIRONMENT MONITORING OF CONTROLS RISK ASS PROCESS CONTROL ACTIVITIES IT AND COMM SYSTEM
TRANSACTION LEVEL CONTROLS Designed to reduce risk of mis-statement due to error or fraud and to ensure that processes are operating effectively Controls can include any procedure used and relied upon by clients to prevent errors running or to detect and correct errors that occur. Give Andela Example select passwords/no surprise approach 22
CONTROL OBJECTIVES To prevent or detect mis-statements in the financial report OR To support automated parts of the business in functioning of controls in place 23
TYPES OF CONTROLS 1. Manual 2. Automated/ application controls 3. IT generated controls 4. IT dependent control Examples: Fraud software info sys/ New Technology (online p/m, sourcing, M-Pesa - APPS)/Mobile Wallet/Banks and Software credit dept./ Changing role of AC 24
TYPES OF CONTROLS cont. Speed Cameras - preventive Alco-blow - Photo DETECT DETECT NORMAL CONTROLS IT DEPENDENT MANUAL CONTROLS AUTOMATED CONTROLD PREVENT PREVENT 25
TYPES OF CONTROLS cont. 26 Automated Controls normally becoming bigger based on size of Business Manual Automated No internet No WIFI No Battery No Back - up
WHAT IS THE TEST OF CONTROL Audit Procedure performed to test the operating effectiveness of controls in preventing or detecting and correcting material mis-statements at the assertion level Controls- think of them as two types : Preventing Controls and Detecting Controls 27
PREVENT CONTROLS Can be applied to each transaction during normal processing to avoid errors occurring What could go wrong Assertion Prevent Control Sales occur that are not recoverable Occurrence Existence The computer programme will not allow a sale to be processed if a customer has exceeded its credit Fictitious employees are paid Sales are recorded at an incorrect value Transactions are classified and coded to incorrect accounts Occurrence Amounts are not able to be paid to the employees without first matching a valid tax file number to the employee master file Accuracy Sales invoices are automatically priced using the information in the price master file Classification Account coding on each purchase order is checked by the computer to a table of valid account numbers, and then various logic tests are performed by the computer 28
DETECTING CONTROLS These are necessary to identify and correct errors that do enter the records. Not normally applied to transactions during normal flow and processing Example: IA reports that are never acted upon What could go wrong Assertion Detect Control Cash is received but not recorded in the ledger, payments are made but not recorded, cash receipts/payments are not real or not recorded on a timely basis Shipments not billed and recorded, and billings are not related to the actual shipments or product Unrecorded billings and errors in classifying sales or cash receipts Among other things, errors in the number of units or unit prices being calculated or applied incorrectly Completeness Occurrence Cut-off Completeness Occurrence Completeness Classification Accuracy Bank reconciliation and follow up of unexpected outstanding items (e.g. unexpected or large deposits not yet cleared by the bank, cheques presented by the bank but not recorded in the general ledger The computer performs a daily comparison of quantities shipped to quantities billed. If differences are detected, a report is generated for review and follow up by the billing supervisor Quarterly reviews of credit balances in accounts receivable to determine their causes The sales manager reviews daily shipments, total sales, and sales per unit shipped 29
AUTOMATED CONTROLS - IT CONTROLS Normal IT Development DEVELOPERS TESTS TESTING LIVE/ PRODUCTION STAFF/CLIENTS IMPORTANT: SEGRGATION OF DUTIES 30
TECHNIQUES FOR TESTING CONTROLS 1 Enquiry 2 3 4 5 Observation Inspection of physical evidence Re-performing tasks Professional judgement and Professional skepticism 31
SELECTING AND DESIGNING TESTS OF CONTROL 1. Select controls that will provide efficient and effective audit evidence 2. Test controls that have impact on opinion/risk 3. Test controls that have multiple impact 4. Normally do control testing at interim stage, with resultant impact on level of substantive testing 32
RESULTS OF THE CONTROL TESTING 33 Do results of control testing confirm preliminary evaluation of controls and control risk based on internal control documentation? If so, do not modify planned substantive procedure If not, revise audit risk assessment and audit strategy to substantive based
DOCUMENTING CONCLUSIONS 34 Document results of control testing in working papers 1. Test performed 2. Purpose of test of controls 3. Actual controls selected for testing 4. Results of testing Document in sufficient detail to allow another auditor to perform the same tests Give example of UN (E-mails behind documentation of field offices, receipts lost)
TODAY S CONTROLS HOW ARE THEY DIFFERENT FROM WHEN WE STARTED? Example: E mail Login/KRA Portal Example OR Bank Portal Example IT CONTROL Try incorrect login Try login for old staff members (From HR Password frequency change Match e-mail number to HR file View exception reports 35
SUBSTANTIVE TESTING Introduction to Principle of Directional Testing 1. When testing for understatement (normally credit entries), items will be selected from source documents (eg GDN for sales; GRN for purchases). 2. When testing for overstatement(normally debits) the items will be selected from recorded amounts, eg PDB for purchases) 3. To achieve objectives we use audit assertions: Occurrence, Completeness, Accuracy, Cut Off, Classification, Existence, Rights) 4. As part of risk assessment we identify SIGNIFICANT RISKS (for these ICS tests a must) 36
SUBSTANTIVE TESTING 37 Which key substantive standards apply to substantive tests? In designing substantive analytical procedures, the auditor considers such matters as the following: The suitability of using substantive analytical procedures given the assertions. The reliability of the data, whether internal or external, from which the expectation of recorded amounts or ratios is developed. Whether the expectation is sufficiently precise to identify a material misstatement at the desired level of assurance. The amount of any difference in recorded amounts from expected values that is acceptable.
SUBSTANTIVE TESTING Which key substantive standards apply to substantive tests? ISA 330 (Auditor response to assessed Risk) The greater the risk of material misstatement, the greater the extent of substantive procedures. Because the risk of material misstatement takes account of internal control, the extent of substantive procedures may be increased as a result of unsatisfactory results from tests of the operating effectiveness of controls. However, increasing the extent of an audit procedure is appropriate only if the audit procedure itself is relevant to the specific risk. 38
SUBSTANTIVE TESTING The auditor designs tests of details responsive to the assessed risk with the objective of obtaining sufficient appropriate audit evidence to achieve the planned level of assurance at the assertion level In designing substantive analytical procedures, the auditor considers such matters as the following: The suitability of using substantive analytical procedures given the assertions. The reliability of the data, whether internal or external, from which the expectation of recorded amounts or ratios is developed. Whether the expectation is sufficiently precise to identify a material misstatement at the desired level of assurance. The amount of any difference in recorded amounts from expected values that is acceptable The greater the risk of material misstatement, the greater the extent of substantive procedures. Because the risk of material misstatement takes account of internal control, the extent of substantive procedures may be increased as a result of unsatisfactory results from tests of the operating effectiveness of controls. 39
SUBSTANTIVE TESTING Even when controls are good, the auditor will carry out test on the figures in the FS. The audit has to address all assertions made by each material figure. These are substantive tests. They comprise of: 1. Analytical procedure 2. Tests of details Physical examinations Confirmations Documentation Inquiries Recalculations Observation 40
SUBSTANTIVE TESTING Examples: Payroll Rent + Rates/ Rental Income/ Valuation Travel Ratios Trend Ratios Trend analysis Reasonableness Testing 41
ANALYTICAL PROCEDURES 42 A/R should be based on the nature of client, availability of financial and non financial information, reliability of data, costs of such A/R tests. Examples are trend analysis, ratio analysis, reasonableness tests, proof in total We need to determine the expectation and test to that CONCLUSION: RISK BASED AUDIT (PLAY THE CLIP)- ITS ALL ABOUT RISK MANAGEMENT
TEST OF DETAIL vs CONTROL TESTS SUBSTANTIVE TESTING IN THE REVENUE CYCLE Planning for Direct Tests of Transactions and Account Balances Audit objectives and assertions Account balance relationships Risk of material misstatement Composition of the account Persuasiveness of audit procedures Cost of audit procedures Timing of audit procedures Determining optimal mix of audit procedures 43
TEST OF DETAIL vs CONTROL TESTS Assertions related to revenue transactions: Occurrence: Have the transactions occurred and pertain to the entity Completeness: Have all transactions been recorded Accuracy: Have transactions been accurately recorded Cutoff: Have transactions been recorded in the correct accounting period Classification: Have transactions been recorded in the proper accounts 44
TEST OF DETAIL vs CONTROL TESTS Substantive Tests of Revenue for Occurrence, Accuracy, and Valuation Vouch recorded sales transaction back to customer order and shipping document Compare quantities billed and shipped with customer order Special care should be given to sales recorded at the end of the year Scan sales journal for duplicate entries 45
TEST OF DETAIL vs CONTROL TESTS Substantive Tests of Revenue Cutoff Tests Can be performed for sales, sales returns, cash receipts Provides evidence whether transactions are recorded in the proper period Cutoff period is usually several days before and after balance sheet date Extent of cutoff tests depends on effectiveness of client controls 46
TEST OF DETAIL vs CONTROL TESTS Substantive Tests of Revenue Cutoff Tests Sales cutoff Auditor selects sample of sales recorded during cutoff period and vouches back to sales invoice and shipping documents to determine whether sales are recorded in proper period Cutoff tests assertions of existence and completeness Auditor may also examine terms of sales contracts Sales return cutoff Client should document return of goods using receiving reports Reports should date, description, condition, quantity of goods Auditor selects sample of receiving reports issued during cutoff period and determines whether credit was recorded in the correct period 47
TEST OF DETAIL vs CONTROL TESTS Substantive Tests of Revenue for Completeness Use of pre-numbered documents is important Analytical procedures Cutoff tests Auditor selects sample of shipping documents and traces them into the sales journal to test completeness of recording of sales 48
FRAUD INDICATORS AND AUDIT ROCEDURES Potential fraud indicators: Excessive credit memo or other adjustments to accounts receivable just after year-end Customer complaints and discrepancies in receivable confirmations Unusual entries to the receivable subsidiary ledger or sales journal Missing or altered source documents Lack of operating cash flow when operating income has been reported Unusual reconciling differences between receivable subsidiary ledger and control account Sales in the last month with unusual terms Pre- or post-dated transactions Unusual adjustments to sales accounts just before or after year-end 49
FRAUD INDICATORS AND AUDIT ROCEDURES Cont Substantive procedures that may highlight potential fraud indicators: Review of source documents including invoices, shipping documents, customer purchase orders, etc. Review and analyze credit memos and other adjustments to receivables Confirm sales terms with customers Analyze large or unusual sales made near year-end Scan the general ledger, receivables subsidiary ledger, and sales journal for unusual activity Perform analytical review of credit memo and write-off activity Analyze recoveries of written-off accounts 50
FRAUD INDICATORS AND AUDIT ROCEDURES Cont What analytical analysis can be done for possible misstatements? Compare client revenue trend with economic conditions and industry trends Compare cash flow from operations with net income Perform analytical procedures Ratio analysis Trend analysis Reasonableness tests 51
ASSESSMENT OF ENVIRONMENTAL RISK Document operation of accounting applications and important controls Develop preliminary assessment of environment risk If control risk is high, determine likely types of misstatements If control risk is lower, develop procedures to test operation of controls Perform tests of controls, document results Based on the results of testing, reassess control risk 52
INHERENT RISK WITH REGARD TO SALES RISK Impact of any unusual sales terms and whether title passed to customer Example: related party transactions Goods recorded as sales have been shipped Sales made with recourse or that have significant returns Example: irrevocable right to return goods The presence of these issues increase inherent risk and the probability of material misstatement 53
THE CONTROL ENVIRONMENT AND SALES An organization's control environment affects revenue and related transactions more than most accounts The auditor must consider: Management's integrity Financial condition of the organization Financial pressures on the organization Management incentives to achieve financial results 54
UNDERSTANDING INTERNAL CONTROLS 55 Although the auditor must understand all components of internal controls, particular attention is paid to significant control procedures and monitoring controls The auditor obtains an understanding of the controls by Walk-through of the processing of transactions Inquiry Observation Review of client documentation It is critical this understanding be documented in the work papers
56 UNDERSTANDING INTERNAL CONTROLS Cont.. Internal control procedures should be sufficient to ensure the management assertions are achieved: Existence/Occurrence: sales are recorded only when shipment has occurred and the primary revenue producing activity has been performed Completeness: all valid sales transactions are recorded Rights/obligations Valuation Presentation and disclosure
WHAT ARE THE 3 COMPONENTS OF CONTROL RISK 1. Monitoring Controls 2. Control Structure for Returns, Allowances, and Warranties 3. Importance of Credit Policies Authorizing Sales 57
MONITORING CONTROLS Designed to signal failures in transaction processing, and determine if timely, corrective action is taken Monitoring controls applicable to revenue transactions include: Compare sales and cost of good sold with budgeted amounts Exception reports generated to identify unusual transactions Internal audit of revenue cycle controls Computer reconciliation of transactions entered with transactions processed Monitoring of accounts receivable for quality Independent follow-up on customer complaints Audits of sales tax collections 58
TEST OF DETAIL vs CONTROL TESTS 59 THANK YOU Q & A